MENU
SCENARIO: Critical servers show signs of erratic behavior within your organization's intranet. Initial information indicates the systems are under attack from an outside entity. As the Chief Information Security Officer (CISO), you decide to deploy the Incident Response Team (IRT) to determine the details of this incident and take action according to the information available to the team.
In what phase of the response will the team extract information from the affected systems without altering original data?
Suggested Answer: C
Get Premium 712-50 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
30 comments · newest first
DE
Demetra
11 months ago
I’m surprised this is even a question; everyone should know it’s Investigation!
SH
Shawna
11 months ago
Recovery phase is for fixing things, not extracting info!
HE
Hector
11 months ago
Wait, are we sure it's not the Response phase? Seems like a gray area.
FA
Fabiola
12 months ago
I agree, Investigation is key for preserving data integrity.
DE
Deandrea
12 months ago
It's definitely the Investigation phase! That's where we gather evidence.
QU
Quiana
1 year ago
I’m a bit confused. Could it also be part of the Response phase? I feel like both phases involve some level of data handling.
PA
Pamella
1 year ago
I practiced a similar question, and I believe it's definitely the Investigation phase. That's when you gather all the details before moving on to recovery.
JE
Jeanice
1 year ago
I'm not entirely sure, but I remember something about the Response phase being more about containment and not really about extracting data.
SH
Sherman
1 year ago
I think the phase where the team extracts information without altering original data is the Investigation phase. It makes sense since they need to analyze the evidence carefully.
LI
Lizbeth
1 year ago
I'm a bit confused by this question. The scenario talks about the IRT being deployed, but it's not clear to me which phase that would correspond to. I'll need to review the incident response process steps to figure out which one involves extracting data without altering it. Might be worth jotting down some notes on the different phases.
FE
Felicidad
1 year ago
Okay, let's see here. The key is extracting information without altering the original data. That sounds like the Investigation phase to me, where the team would be collecting and analyzing evidence. I'm pretty confident that's the right answer, but I'll double-check the definitions of the phases just to be sure.
CO
Cordelia
1 year ago
Hmm, I'm a little unsure about this one. The question mentions the IRT being deployed, so I'm wondering if that means the Response phase is the correct answer. I'll have to think through the different phases of the incident response process to be sure.
DE
Delbert
1 year ago
This seems like a pretty straightforward incident response question. I'm going to focus on the key details - the systems are showing erratic behavior and the IRT has been deployed to investigate. The question is asking about the phase where they extract information without altering the original data, so I'm thinking that's the Investigation phase.
YU
Yuette
2 years ago
B) Investigation is the way to go. You don't want the team to be like a bull in a china shop, you know? Gotta be careful and delicate when gathering that evidence. Hey, at least they won't be playing 'Capture the Flag' with the servers!
CA
Carmela
1 year ago
D) Follow-up
SH
Sharan
1 year ago
C) Recovery
RE
Ressie
1 year ago
B) Investigation
EV
Evan
1 year ago
A) Response
NI
Niesha
2 years ago
I'm going with B) Investigation. That's where the real detective work happens, and you can't afford to mess it up by accidentally changing the evidence. Unless, of course, you're secretly the culprit and want to cover your tracks. Just joking, just joking!
BA
Barbra
1 year ago
User 2: Definitely, we need to be careful not to disturb the original data during this phase.
KE
Keena
1 year ago
User 1: I agree, B) Investigation is crucial for gathering evidence without altering it.
TA
Taryn
2 years ago
B) Investigation makes the most sense here. You need to extract information without altering the original data to understand what's happening and how to respond effectively. Anything else would just be guesswork.
TR
Truman
2 years ago
I believe it's important to not alter original data during the Investigation phase to preserve evidence for analysis.
YU
Yuriko
2 years ago
The answer is clearly B) Investigation. That's when the team will gather and analyze the evidence without modifying the original data. I've seen this in my training, and it's crucial for preserving the integrity of the investigation.
RY
Ryan
1 year ago
Absolutely. The investigation phase is crucial for gathering information and understanding the scope of the incident before taking further action.
MI
Miesha
1 year ago
I agree. Altering the original data during the investigation phase can lead to inaccurate conclusions and compromise the entire incident response.
CA
Carolann
1 year ago
That's correct. It's important to preserve the original data to ensure the integrity of the investigation process.
CA
Carisa
1 year ago
Yes, you're right. During the investigation phase, we need to carefully collect and analyze the evidence without changing anything.
LE
Leota
2 years ago
I agree with Salina, in the Investigation phase, they gather information without altering data.
SA
Salina
2 years ago
I think the team will extract information in the Investigation phase.